Heroku Changelog
Inactive expired SSL certificates will be cleaned up after one month

Change effective on
10 April 2014

As noted in the SSL documentation, inactive expired certificates will be cleaned up after one month.

When heroku certs:update is run, the existing certificate is made inactive, and is retained for roll-back purposes. When these inactive certificates expire, they will now be removed after a one month period. This will not impact active certificates, or inactive certificates which are still valid.